Method for managing computer network access

ABSTRACT

In a method of controlling computer network access, a server computer receives via a computer network from an endpoint computer of the computer network a request for an access configuration file. In response, the server computer dispatches to the endpoint computer an access configuration file. Thereafter, the server computer dispatches to the endpoint computer an update to the dispatched access configuration file or another access configuration file. The server computer can store data received from the endpoint computer regarding a violation of at least one policy included in the access configuration file, the updated access configuration file, or the other access configuration file. The server computer can either dispatch a unique access configuration file to each endpoint computer for which a unique access configuration file was prepared or dispatch a generic access configuration file to each endpoint computer for which a unique access configuration file was not prepared.

CROSS REFERENCE TO RELATED APPLICATIONS

The present application is a divisional of U.S. patent application Ser.No. 13/153,931, filed Jun. 6, 2011, which is a continuation of U.S.patent application Ser. No. 10/055,407, filed Jan. 23, 2002, now U.S.Pat. No. 7,958,237, which claims priority from U.S. Provisional PatentApplication No. 60/263,536, filed Jan. 23, 2001, all of which areincorporated herein by reference in their entirety.

BACKGROUND OF THE INVENTION Field of the Invention

The present invention relates to monitoring and controlling of dataassociated with transactions occurring over a computer network, such asa local area network, a wide area network or the Internet.

Description of Related Art

Recent studies indicate that more than 50% of all computer network,e.g., Internet, transactions taking place within an organization are notbusiness related. To this end, 79% of all organizations have detectedemployee abuses of Internet access privileges. Moreover, 64% oforganizations participating in a survey acknowledge financial loses fromabuses of Internet access privileges. In addition, because of its easeof use and the misguided perception that the Internet is a securecommunication medium, the Internet has engendered an increase in sexualharassment and other hostile workplace issues.

As a result, there is an increasing need to control computer networkaccess to prevent abuses and/or to provide evidence to support employeedisciplinary action. In addition, there is a need to reduce or eliminatemisuse of a computer network within organizations in order to preservethe network bandwidth for work related purposes. Lastly, there is a needfor an enforcement tool to back computer network acceptable usepolicies. However, at the present time, no means exists that fulfillsall of these needs.

It is, therefore, an object of the present invention to overcome theabove problems and others by providing a method for controlling computernetwork access where each user's access to the computer network can beselectively controlled and records of each user's computer networktransactions, especially prohibited transactions, can be stored forsubsequent retrieval and analyses. Still other objects of the inventionwill become apparent to those of ordinary skill in the art upon readingand understanding the following detailed description.

SUMMARY OF THE INVENTION

Accordingly, we have invented a method for controlling computer networkaccess. The method includes initiating at a client computer a firstcommunication session at a first network address and receiving at theclient computer via the first communication session a second networkaddress. A second communication session is initiated at the clientcomputer at the second network address. The client computer receives viathe second communication session an access configuration including acontrol setting for at least one communication protocol capable of beingutilized during a third communication session. A process is instantiatedon the client computer which initiates a third communication session ata third network address. Lastly, in connection with the thirdcommunication session, the conveyance of data to and/or from the processinstantiated on the client computer is controlled based on the controlsetting for the one communication protocol.

The access configuration can include a list related to the controlsetting for the one communication protocol. The conveyance of data viathe third communication session can be controlled based on the list.

The communication protocols capable of being utilized include World WideWeb (WWW or Web), File Transfer Protocol (FTP), E-mail, News, Chat,Instant Messaging, Telnet and Peer-to-Peer. These protocols representgeneric classes of communication protocols. The specific listing ofthese protocols is not to be construed as limiting the scope of theinvention since the present invention is capable of operating withother, unspecified, protocols or classes of protocol.

The control setting can include unrestricted computer network access(Allow All); no computer network access (Block All); limited computernetwork access to network addresses included in an allow list (AllowListed); and unrestricted computer network access except to networkaddresses included in a block list (Block Listed). The accessconfiguration can further include at least one of the following globalcontrol settings: access prohibited to convey data having apredetermined word and/or phrase; access prohibited to data of at leastone predetermined data type, e.g., cookies; access prohibited to dataconveyed during at least one of a predetermined time and day-of-week;and access prohibited based on a rating for a category included with theconveyed data. The conveyance of data to and/or from the processinstantiated on the client computer can also be based on the at leastone global control setting.

The method can further include the step of terminating the firstcommunication session after the client computer receives the secondnetwork address. The second communication session can also be terminatedafter the client computer receives the third network address.

At suitable times, the client computer can transmit via the secondcommunication session a request to receive another access configurationincluding a control setting for the one communication protocol. Inresponse to this request, the client computer receives via the secondcommunication session the other access configuration. The conveyance ofdata to and/or from the process instantiated on the client computer canbe controlled based on the control setting included in the other accessconfiguration,

The step of controlling the conveyance of data can include the steps ofdetermining the communication protocol from the conveyed data anddetermining from the thus determined communication protocol the controlsetting therefor. The method can also include the step of transferringat least part of the control data to the second network address via thesecond communication session. This transferred data can include anetwork address and/or a subject of the third communication session.Lastly, the method can include the step of transferring with the data alogin name received by the client computer during a login procedure by auser thereof.

We have also invented a method for controlling computer network accessthat includes storing a first network address at a client computer. Afirst communication session is initiated between the client computer anda first server computer at the first network address. The clientcomputer receives a second network address from the first servercomputer via the first communication session. A second communicationsession is initiated between the client computer and a second servercomputer at the second network address. The client computer receivesfrom the second server computer an access configuration including acontrol setting for at least one communication protocol capable of beingutilized during a third communication session. A process is instantiatedon the client computer which initiates a third communication sessionbetween the client computer and a remote computer at a third networkaddress. In connection with the third communication session, theconveyance of data to and/or from the instantiated process on the clientcomputer is controlled based on the control setting for the onecommunication protocol.

The first and second server computers can be the same server computer.

The method can further include the step of terminating the firstcommunication session after the client computer receives the secondnetwork address. The second communication session can also be terminatedafter the client computer receives the third network address.

The access configuration can also include at least one of the followingglobal control settings: access prohibited to convey data having apredetermined word and/or phrase; access prohibited to data having atleast one predetermined data type; access prohibited to data conveyedduring at least one of a predetermined time and day-of-week; and accessprohibited based on a rating for a category included with the conveyeddata. The step of controlling the conveyance of data to and/or from theprocess instantiated on the client computer can also be based on the atleast one global control setting.

Prior to receipt of the access configuration at the client computer, thecontrol setting for the one communication protocol is selected from aplurality of different control settings therefor. Each global controlsetting is selected nonexclusively of any other global control settings.

The method can also include the steps of initiating at the clientcomputer via the second communication session a request to the secondserver computer to transmit another access configuration. The otheraccess configuration can be received at the client computer from thesecond server computer. Thereafter, the conveyance of data to and/orfrom the instantiated process on the client computer can be controlledbased on a control setting included in the other access configurationfor the one communication protocol.

The control setting for the one communication protocol can have a listassociated therewith. The conveyance of data via the third communicationsession can be controlled based upon an entry, e.g., a network address,included in the list.

Lastly, the method can include the step of determining the communicationprotocol from the conveyed data.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of hardware utilized to implement a method inaccordance with the present invention;

FIG. 2 is a schematic drawing of a dialog box for selecting controlsettings utilized for controlling computer network access in accordancewith the present invention;

FIGS. 3a-3e are schematic drawings of Allow Lists and Block Listsutilized for controlling various types of communication protocols inaccordance with the present invention;

FIG. 4 is a schematic drawing of a restricted word and phrase list forcontrolling computer network access in accordance with the presentinvention;

FIG. 5 is a schematic drawing of a dialog box for selecting whether tostore text and/or encoded attachments associated with computer networktransactions in accordance with the present invention;

FIG. 6 is a schematic drawing of a dialog box for selecting the timesand days a user is granted access to a computer network;

FIG. 7 is a schematic drawing of a dialog box for displaying dataregarding computer network activity of a user; and

FIG. 8 is a schematic drawing of a dialog box for selecting one or morelevels of control for contents of a computer network transaction basedon a voluntary rating included with the data conveyed with thetransaction.

DETAILED DESCRIPTION OF THE INVENTION

The present invention is a software program which is configured tooperate on a plurality of computers connected together via a computernetwork, such as a local area network, a wide area network or theInternet.

The software program has two major components, namely, a server controlmanager (SCM) and a client control manager (CCM). The SCM is installedon one of the computers which, in the context of the computer network,operates as a server computer. The SCM can also be installed across twoor more computers which co-act to perform the function of a servercomputer. The CCM is installed on one or more client computers connectedto the server computer via the computer network. The SCM and the CCMco-act in a manner to be described hereinafter.

The SCM includes an access manager that an administrator of the servercomputer utilizes to establish an access configuration for each user orgroup of users of the client computers. This access configuration isstored at the server computer and, at an appropriate time, is suppliedto a client computer to define for the user of the client computercomputer network access rights and access restrictions of the user.Lastly, the access manager also enables the administrator of the servercomputer to view, sort and analyze data related to actual or attemptedcomputer network transactions by the user of a client computer havingthe CCM installed thereon.

With reference to FIG. 1, a client computer 1, a server computer 2 and aremote computer 3 are connected to a computer network 4. Optionally,another server computer 5 which co-acts with server computer 2 isconnected to computer network 4. Computers 1, 2, 3, and 5 are eachassigned unique network addresses that enable each computer tocommunicate with the other computers via computer network 4. Computernetwork 4 can include one or more servers (not shown) and/or one or morerouters (not shown) that facilitate communication between computer 1, 2,3 and 5 based upon the network addresses assigned to each computer.

Client computer 1 includes a memory unit 6 for storing communicationsoftware 7. Client computer 1 also includes a mouse 8, a keyboard 9 anda display 10 which collectively operate as a man-machine interfacebetween client computer 1 and a user thereof. Server computer 2 includesa memory unit 11 for storing a server control manager software (SCM) 12.Server computer 2 also includes a mouse 13, a keyboard 14 and a display15 which collectively operate as a man-machine interface between servercomputer 2 and the administrator thereof. Remote computer 3 includes amemory unit 16 for storing communication software 17, Remote computer 3also includes a mouse 18, keyboard 19 and display 20 which collectivelyact as a man-machine interface between remote computer 3 and a userthereof. Lastly, server computer 5 includes a memory unit 21 for storingan SCM 22. Server computer 5 also includes a mouse 23, a keyboard 24 anda display 25 which collectively operate as a man-machine interfacebetween server computer 5 and an administrator thereof. Communicationsoftware 7 and 17, and SCM 12 and 22 control the operation of clientcomputer 1, server computer 2, remote computer 3 and server computer 5,respectively, to communicate data therebetween in a manner known in theart. In FIG. 1, one client computer 1 is shown. However, the presentinvention is scalable to operate on a plurality of client computers 1connected to server computer(s) 2 and/or 5 via computer network 4.

SCM 12 can display on display 15 a plurality of dialog boxes that theadministrator of server computer 2 utilizes to select control settingsof each user or user group of one or more of client computers 1. Morespecifically, the control settings of each user or user group can beindividually selected based on a login name assigned to each user oruser group. . A generic set of control settings can also be selected foreach user or user group not having unique control settings selectedtherefor based on a login name assigned to each user or user group. Theselection of the control settings for a user or user group of clientcomputer 1 will now be described with reference to FIGS. 2-6 and withcontinuing reference to FIG. 1. For convenience of description, thepresent invention will be described in connection with a user of clientcomputer 1. However, it is to be appreciated, that the present inventionis also usable in connection with a plurality of users of one or moreclient computers 1 and/or one or more user groups of one or more clientcomputers 1, where each user and/or user group has a unique login name.

Initially, the administrator of server computer 2 utilizes the accessmanager to assign a login name to a user of client computer 1. Thislogin name is stored in an access configuration, to be describedhereinafter, and is utilized as the basis for associating the controlsettings selected by the administrator of server computer 2 for the userassociated with the login name. Next, the administrator of servercomputer 2 causes the access manager to display on display 15 a controlsettings dialog box 28, shown in FIG. 2, associated with the login nameof the user. Control settings dialog box 28 includes an activity controlsetting section 30, a global control setting section 32 and a pushbutton section 34. Activity control setting section 30 includes aplurality of columns 36-1-36-5, each of which is related to a particularcommunication protocol, and a plurality of rows 38-1-38-5 each of whichis related to a particular control setting for each communicationprotocol in columns 36-1-36-5. The intersection of each row column 36and each row 38 includes a selection means, such as a radio button 40,which the administrator of server computer 2 selects, in a manner knownin the art in order to select the control setting desired for eachcommunication protocol.

The communication protocols shown in columns 36-1-36-5 include Web, FTP,E-mail, News and Chat, respectively. In addition, other communicationprotocols, such as Instant Messaging, Telnet and Peer-to-Peer can alsobe included in a column 36 of activity control setting section 30. It isto be understood that the foregoing communication protocols are genericexamples of communication protocols. Accordingly, the followingdescription of the present invention in connection with any of theforegoing communication protocols is not to be construed as limiting theinvention since the present invention can be adapted to work with anyknown or hereinafter developed communication protocol. The controlsettings included in rows 38-1-38-5 include Off, Allow All, AllowListed, Block All and Block Listed, respectively. Activity controlsetting section 30 is shown for purpose of illustration and is not to beconstrued as limiting the invention since the administrator of servercomputer 2 can change the number of columns 36 and/or rows 38, thecommunication protocol assigned to each column 36 and/or the controlsetting assigned to each row 38 in any desired manner.

In operation, the administrator of server computer 2 selects a desiredradio button 40 for each communication protocol in columns 36-1-36-5 inorder to select the desired control setting therefor. In order to avoidthe selection of conflicting control settings for each communicationprotocol, the selection of one radio button 40 in a column 36 ismutually exclusive of the selection of any other radio buttons 40 in thesame column 36. The access manager is also configured to highlight as adefault selection the radio button 40 associated with the Allow Allcontrol setting, i.e., radio button 40 in row 38-2, of eachcommunication protocol. The selection of any other radio button 40 ineach column 36 will override this default selection.

With reference to FIGS. 3a -3 e, and with continuing reference to allprevious Figs., the Allow Listed control setting in row 38-3 for eachcommunication protocol in columns 36-1-36-5 has associated therewith anallow list 46-1-46-5, respectively. Each Allow List 46 includes a listof network addresses that the user having the login name associated withcontrol settings dialog box 28 is permitted to access for thecorresponding communication protocol. Each network address can includean alpha string, a numeric string, a symbol string or some combinationthereof. If radio button 40 for the Allow Listed control setting for theWeb protocol (column 36-1) is selected, access by the user having thelogin name associated with dialog box 28 will be permitted only to thenetwork addresses included in allow list 46-1. Similar comments apply inrespect of the selection of radio buttons 40 for the Allow Listedcontrol settings associated with the FTP protocol (column 36-2), theE-mail protocol (column 36-3), the News protocol (column 36-4) and theChat protocol (column 36-5) for network addresses included in allowlists 46-2-46-5, respectively.

The Block Listed control setting in row 38-5 for each communicationprotocol in columns 36-1-36-5 has associated therewith a block list48-1-48-5, respectively. Each block list 48 includes a list of networkaddresses that the user having the login name associated with controlsettings dialog box 28 is not permitted to access for the correspondingcommunication protocol. For example, if radio button 40 for the BlockListed control setting for the Web protocol (column 36-1) is selected,access by the user having the login name associated with dialog box 28will not be permitted to network addresses included in block list 48-1.Similar comments apply in respect of the selection of radio buttons 40for the Block Listed control settings associated with the FTP protocol(column 36-2), the E-mail protocol (column 36-3), the News protocol(column 36-4) and the Chat protocol (column 36-5) for network addressesincluded in block lists 48-2-48-5, respectively.

If radio button 40 for the Allow All control setting for the Webprotocol (column 36-1) is selected, the user having the login nameassociated with dialog box 28 is granted unlimited access to any networkaddresses utilizing this communication protocol. Similar comments applyin respect of the selection of radio buttons 40 for the Allow Allcontrol settings associated with the FTP protocol (36-2), the E-mailprotocol (column 36-3), the News protocol (column 36-4) and the Chatprotocol (column 36-5) for granting the user unlimited access to allnetwork addresses that utilize the corresponding communication protocol.

If radio button 40 for the Block All control setting for the Webprotocol (column 36-1) is selected, the user having the login nameassociated with dialog box 28 is denied access to all network addressesutilizing this communication protocol. Similar comments apply in respectof the selection of radio buttons 40 for the Block All control settingsassociated with the FTP protocol (column 36-2), the E-mail protocol(column 36-3), the News protocol (column 36-4) and the Chat protocol(column 36-5) for denying access to network addresses that utilize thecorresponding communication protocol.

If the Allow All, Allow Listed, Block All or Block Listed controlsetting is selected for a particular communication protocol, each timethe user of client computer 1 attempts a network transaction utilizingthis communication protocol, a record of the transaction is stored inmemory unit 11 of server computer 2 in a manner to be describedhereinafter.

If radio button 40 for the Off control setting for the Web protocol(column 36-1) is selected, the user having the login name associatedwith dialog box 28 is granted unlimited access to any network addressesutilizing this communication protocol. However, no record of eachtransaction that uses the Web protocol is stored in memory unit 11 ofserver computer 2. Similar comments apply in respect of the selection ofradio buttons 40 for the Off control settings associated with the FTPprotocol (column 36-2), the E-mail protocol (column 36-3), the Newsprotocol (column 36-4) and the Chat protocol (column 36-5) for grantingunlimited access to any network addresses that utilize the correspondingcommunication protocol and not storing a record of each transaction inmemory unit 11 of server computer 2.

With reference to FIG. 4, and with continuing reference to all previousFigs., global control settings section 32 includes boxes 39-1-39-3. Inresponse to selecting box 39-1, if a transaction conveys data having atleast one word and/or phrase included in a restricted word and phraselist 50, transmission of the data to or from communication software 7will be blocked. In response to selecting box 39-2, the transmission toor from communication software 7 of “behind-the-scenes” data, i.e., datathat is not directly presented to the user, such as cookies, is blocked.

Push button section 34 includes an Ok push button 42 and a Cancel pushbutton 44. In response to selecting Ok push button 42, server computer 2stores in the access configuration for the login name associated withdialog box 28 (i) an indication of the radio buttons 40 selected foreach type of communication protocol, (ii) an indication of the boxes39-1 and 39-2 selected, and (iii) the Allow Lists 46-1-46-5, the BlockLists 48-1-48-5 and the restricted word and phrase list 50. This accessconfiguration is stored in memory unit 11 of server computer 2 fordownload to client computer 1 for use by the user thereof entering intoclient computer 1 during a login procedure the login name which isstored in the access configuration. Since the lists 46, 48 and 50 foreach user are stored at server computer 2, the administrator of servercomputer 2 can update each list as desired. Selecting Cancel push button54, however, terminates dialog box 28 without storing in the accessconfiguration any selections made in dialog box 28 or any of the lists46, 48 and 50.

With reference to FIG. 5, and with continuing reference to all previousFigs., the administrator of server computer 2 can cause the accessmanager to display on display 15 a cache control dialog box 60associated with the login name of the user. Dialog box 60 includes aselection section 62 including three radio buttons 64-1-64-3. Inresponse to selecting radio button 64-1, server computer 2 will store ina cache memory (not shown) of memory unit 11 a complete or partial copyof any transaction for which a record is stored in memory unit 11 ofserver computer 2, More specifically, if radio button 64-1 is selected,each time a record of a transaction on client computer 1 is stored inmemory unit 11 of server computer 2, a complete or partial copy of thetransaction is stored in the cache memory. If radio button 64-2 isselected, each time a record of a transaction on client computer 1 isstored in memory unit 11 of server computer 2, a complete or partialcopy of the transaction and any encoded attachments conveyed with thistransaction are stored in the cache memory. Lastly, if radio button 64-3is selected, no copy of any transaction or encoded attachments arestored in the cache memory.

The amount of space allocated for cache memory can be selected byentering a desired amount of cache memory in a cache memory size selectfield 66 of dialog box 60. Dialog box 60 can also include a Clear CacheNow push button 68. In response to selecting push button 68, servercomputer 2 erases the contents stored in the cache memory. Lastly,dialog box 60 includes an Ok push button 70 and a Cancel push button 72.In response to selecting Cancel push button 72, the display of dialogbox 60 on display 15 is terminated and any selections made in dialog box60 are not saved in the access configuration for the login nameassociated with dialog box 60. In contrast, in response to selecting Okpush button 70, the display of dialog box 60 on display 15 is terminatedand the selection of one of the radio buttons 64 and the amount of cachememory in cache memory size select field 66 are stored in the accessconfiguration for the login name associated with dialog box 60.

With reference to FIG. 6, and with continuing reference to all previousFigs., the administrator of server computer 2 can cause the accessmanager to display a Logon Hours dialog box 80 on display 15. Dialog box80 includes a time-day array 82 that includes a plurality of timecolumns 86 and a plurality of day rows 88. Utilizing the point and clickmethod, the administrator of server computer 2 can select each box 84formed by the intersection of columns 86 and rows 88 of time-day array82.

Dialog box 80 also includes an Allow push button 90, a Disallow pushbutton 92, a Cancel push button 94 and an Ok push button 96. In responseto selecting Allow push button 90, any selected boxes 84 will be markedwith a suitable Allow indicia. Similarly, in response to selectingDisallow push button 92, any selected boxes 84 will be marked with asuitable Disallow indicia. Based on the Allow or Disallow indiciaincluded in the various boxes 84, a user of client computer 1 having thelogin name associated with dialog box 80 will be allowed or disallowednetwork access at the corresponding time and day of week. As a defaultselection, in the absence of disallowing computer network access atcertain times and certain days, the user of client computer 1 having thelogin name associated with dialog box 80 will have network access atthese certain times and certain days.

In response to selecting Cancel push button 94, the display of dialogbox 80 on display 15 is terminated and any selection of boxes 84 is notsaved in the access configuration for the login name associated with thedialog box 80. In contrast, in response to selecting Ok push button 96,the display of dialog box 80 on display 15 is terminated and the allowedand disallowed times selected in boxes 84 of time-day array 82 arestored as another global control setting in the access configuration forthe login name associated with dialog box 80.

When each Ok push buttons 42, 70 and 96 is selected in dialog boxes 28,60 and 80, respectively, the various selections made in these dialogboxes are saved in the access configuration for the login nameassociated with the dialog box. Once saved, the access configuration foreach user can be modified by the administrator of server computer 2 in amanner known in the art. Preferably, each access configuration includesall of the allow lists 46 and block lists 48.

Once the access configuration has been prepared for a login name of auser of client computer 1, the computer network access of the userlogging into client computer 1 utilizing this login name is controlledas follows. With reference back to FIG. 1, a client control managersoftware (CCM) 98 is stored in memory unit 6 of client computer 1 andoperates as a buffer between communication software 7 and the computernetwork 4. In response to instantiation of communication software 7, CCM98 initiates a first communication session 100 at a first networkaddress of server computer 2. This first network address is stored inMemory Unit 6 for use by CCM 98 to communicate with server computer 2.Once first communication session 100 has been established, CCM 98 causesSCM 12 of server computer 2 to transmit to client computer 1 via firstcommunication session 100 a second network address. This second networkaddress can be another network address hosted by server computer 2 or anetwork address hosted by server computer 5. When server computer 2hosts the second network address, in response to receiving the secondnetwork address, client computer 1 initiates a second communicationsession 102 with server computer 2 at the second network address. Whenthe second network address is hosted by server computer 5, in responseto receiving the second network address, client computer 1 initiates asecond communication session 102′ with server computer 5. Whicheverserver computer 2 or 5 hosts the second network address, the accessconfiguration file for the login name of the user of client computer 1is stored thereat. For convenience of describing the present invention,server computer 2 will be described as hosting the second networkaddress. However, this is not to be construed as limiting the invention.

Once second communication session 102 has been established, CCM 98causes communication software 7 to terminate first communication session100 and causes SCM 12 to download to client computer 1 a copy of theaccess configuration stored in memory unit 11 for the login name enteredinto client computer 1 by the user thereof during a login procedure. Toenable SCM 12 to download the appropriate access configuration, CCM 98transmits to server computer 2 via second communication session 102 thelogin name entered by the user of client computer 1 during the loginprocedure. In response to receiving this login name, SCM 12 searchesmemory unit 11 for the access configuration including this login name.In response to locating this access configuration, SCM 12 transmits acopy of this access configuration to client computer 1 via secondcommunication session 102. If SCM 12 does not locate an accessconfiguration including the login name entered into client computer 1during the login procedure, SCM 12 can transmit a copy of a genericaccess configuration to client computer 1 via second communicationsession 102 e. This generic access configuration can be established bythe administrator of server computer 2 for each user of client computer1 not having a login name included in an access configuration stored inmemory unit 11. Upon receiving the access configuration, CCM 98 storesthe access configuration in memory unit 6.

Once the access configuration is stored in memory unit 6, CCM 98commences monitoring and controlling transactions between communicationsoftware 7 and computer network 4 based thereon For purpose ofdescribing the operation of CCM 98, it will be assumed that the radiobuttons and boxes shown selected in dialog boxes 28, 60 and 80 have beenselected.

Next, the user of client computer 1 initiates concurrent with secondcommunication session 102 a third communication session 104 at a thirdnetwork address of remote computer 3. Once third communication session104 is established, CCM 98 commences monitoring data associated withactual or attempted transactions via third communication session 104.More specifically, CCM 98 determines from the data associated with eachtransaction the communication protocol being utilized. This data caninclude control data and content data. Control data is typically aheader and/or a footer appended to the content data, but is notnecessarily limited thereto. Content data contains the essence of anyinformation, e.g., text, being conveyed via third communication session104. Once CCM 98 determines the communication protocol of thetransaction, CCM 98 determines from the access configuration received byclient computer 1 the control setting that was selected for thiscommunication protocol. For example, if CCM 98 determines that thetransaction utilizes the Web protocol common to communications on theWorld Wide Web, i.e., HTTP, CCM 98 can then determine from the accessconfiguration that the Block Listed control setting was selected for theWeb protocol. Based on the selection of this control setting, CCM 98will utilize block list 48-1. Next, CCM 98 extracts from the controldata of the transaction the network address included therein andcompares this network address to the network addresses included in blocklist 48-1. In the event of a match, CCM 98 blocks the conveyance of datacomprising the transaction to or from communication software 7 of clientcomputer 1. In contrast, in the absence of a match, CCM 98 permits thedata comprising this transaction to be conveyed to or from communicationsoftware 7.

With reference to FIG. 7, and with continuing reference to all previousFigs., at a suitable time, SCM 12 creates in memory unit 11 for eachlogin name an activity list 122 of transactions occurring via thirdcommunication session 104 in connection with this login name. Except forcommunication protocols where the Off control setting was selected incontrol setting dialog box 28, activity list 122 for each login namewill include a record of each actual or attempted transaction occurringvia third communication session 104. Alternatively, activity list 122for each user can include only records of actual or attemptedtransactions that were blocked by CCM 98. For purpose of describing theinvention, it will be assumed that a record is entered in activity list122 for the login name of the user of client computer 1 for each actualor attempted transaction occurring via third communication session 104.

Except for transactions that utilize a communication protocol where theOff control setting was selected in FIG. 2, when an actual or attemptedtransaction via third communication session 104 occurs, CCM 98 transmitsto server computer 2 via second communication session 102 certain dataregarding the transaction. In response to receiving this data, SCM 12forms from this data a record of the transaction which is stored inactivity list 122 associated with the login name of the user of clientcomputer 1. At a suitable time, the administrator of server computer 2can cause SCM 12 to display on display 15 an Activity Log dialog box 120which includes activity list 122 associated with the login name of theuser of client computer 1 that initiated third communication session104. Activity Log dialog box 120 includes columns 124-1-124-6 entitledProtocol, Network Address (NA), Subject, Date/Time, Control and User,respectively, for each record stored in activity list 122. Columns124-1-124-6 in activity log dialog box 120 are shown for purpose ofillustration and are not to be construed as limiting the invention sinceactivity log dialog box 120 can include more or less columns 124, eachof which can be entitled with one of the titles shown in activity logdialog box 120 or with a different title. Exemplary entries of recordsinto activity list 122 for transactions utilizing the communicationprotocols shown in FIG. 2 will now be described.

If an actual or attempted transaction utilizing the Web protocoloccurred via third communication session 104 without CCM 98 blocking theconveyance of data to or from communication software 7, CCM 98 transmitsto server computer 2 via second communication session 102 certain dataregarding the transaction to be included in a record 126 formed by SCM12 in activity list 122 for the login name of the user of clientcomputer 1. As can be seen, record 126 includes in column 124-1 an entrythat the Web protocol was utilized, the Network Address of thetransaction which is entered in column 124-2, the Subject of thetransaction which is entered in column 124-3, a Date/Time of thetransaction which is entered in column 124-4 and the Login name of theuser of client computer 1 which is entered in column 124-6. TheDate/Time entry in column 124-4 of record 126 can be supplied either byCCM 98 when transmitting the data comprising record 126 to servercomputer 2 or by the SCM 12 upon receipt of the data comprising record126 from client computer 1.

Since CCM 98 permitted the data to be conveyed to or from communicationsoftware 7, record 126 does not include any data in Control column124-5. In contrast, record 128 of activity list 122 includes in column124-1 an entry that the Web protocol was utilized and includes incontrol column 124-5 the entry “Block List”. This later entry isincluded in record 128 in response to CCM 98 blocking the conveyance ofdata during a transaction to or from communication software 7 based uponCCM 98 determining that the conveyed data included a network addressthat is also included in block list 48-1.

Activity list 122 also includes a record 130 which includes in column124-1 an entry that the Web protocol was utilized and includes inControl column 124-5 the entry “Allow List”. This later entry isincluded in record 130 when CCM 98 permits the conveyance of data duringa transaction to or from communication software 7 based upon CCM 98determining that the conveyed data included a network address that isalso included in allow list 46-1.

If a communication protocol in a column 36 of activity control settingsection 30 has its Off control setting selected, the accessconfiguration will cause CCM 98 to permit all data having thiscommunication protocol to be conveyed to or from communication software7, but will not cause CCM 98 to transmit to server computer 2 via secondcommunication session 102 any data regarding transactions utilizing thiscommunication protocol. Therefore, no record of transactions utilizingthis communication protocol are included in activity list 122. Incontrast, if the Allow All control setting is selected for acommunication protocol listed in a column 36, the access configurationwill cause CCM 98 to permit all data having this communication protocolto be conveyed to or from communication software 7 and will cause CCM 98to transmit to server computer 2 via second communication session 102data to be included in a record of this transaction in activity list122,

If, in FIG. 2, the Allow All control setting for the FTP protocol isselected, when CCM 98 determines that a transaction occurring via athird communication session 104 utilizes the FTP protocol, dataregarding this transaction is transmitted via second communicationsession 102 to server computer 2 whereupon the SCM forms a record 132 ofthis transaction which is included in activity list 122. Since the AllowAll control setting is selected, CCM 98 permits all data having the FTPprotocol to be conveyed to or from communication software 7.

If, in FIG. 2, the Allow All control setting for the E-mail protocol isselected, when CCM 98 determines that a transaction occurring via thirdcommunication session 104 utilizes the E-mail protocol, data regardingthis transaction is transmitted to server computer 2 via secondcommunication session 102 whereupon the SCM forms a record 134 of thistransaction which is included in activity list 122. In this case, sincethe Allow All control setting was selected, no entry would ordinarily beincluded in Control column 124-5 of record 134. However, in FIG. 2, ifbox 39-1 is selected, CCM 98 compares words and/or phrases included inthe data conveyed with each transaction, regardless of the type ofcommunication protocol, to words and phrases included in the restrictedwords and phrases list 50. If the conveyed data includes one or morewords and/or phrases included in the restricted words and phrases list50, CCM 98 blocks conveyance of this data to or from communicationsoftware 7 and causes SCM 12 to include an appropriate entry, e.g., Wordor Phrase, in Control column 124-5 of record 134.

CCM 98 utilizes a real time time-date clock (not shown) of clientcomputer 1 or a time and date included in the received accessconfiguration to monitor the time and date associated with eachtransaction. If a transaction is attempted at a time and/or date that isdisallowed in the Login Hours dialog box 80 shown in FIG. 6, CCM 98blocks conveyance of the data to or from communication software 7 andtransmits data regarding this transaction to server computer 2 viasecond communication session 102 whereupon SCM 12 forms a record 136 ofthe transaction which is included in activity list 122. Because the userof client computer 1 attempted a transaction at a disallowed time and/ordate, an appropriate entry, e.g., Time or Date, is included in Controlcolumn 124-5 of record 136.

If, in FIG. 2, the Allow Listed control setting for the News protocol isselected, when CCM 98 determines that a transaction occurring via thirdcommunication session 104 utilizes the News protocol, CCM 98 comparesthe network address included with the conveyed data for this transactionto the network addresses listed in allow list 46-4. In the event of amatch, CCM 98 permits the data to be conveyed to or from communicationsoftware 7. However, in the absence of a match, CCM 98 blocks theconveyance of the data to or from communication software 7. In eitherevent, CCM 98 transmits to server computer 2 via second communicationsession 102 data regarding this transaction. In response to receivingthis data, SCM 12 forms a record 138 of this transaction which isincluded in activity list 122. If CCM 98 permitted the data to beconveyed to or from communication software 7, no entry is included inControl column 124-5 of record 138. However, if CCM 98 blocks theconveyance of the data to or from communication software 7, anappropriate entry, e.g., Allow List, is included in Control column 124-5of record 138.

If, in FIG. 2, the Block All control setting for the Chat protocol isselected, when CCM 98 determines that a transaction occurring via thirdcommunication session 104 utilizes the Chat protocol, CCM 98 blocks theconveyance of any data for this transaction to or from communicationsoftware 7 and transmits to server computer 2 via second communicationsession 102 data regarding this transaction. In response to receivingthis data, SCM 12 forms a record 140 of this transaction which isincluded in activity list 122. Record 140 includes an appropriate entry,e.g., Block All, in Control column 124-5 of record 140 to indicate thatthe conveyance of data to or from communication software 7 was blockedbased upon the Block All control setting.

As can be seen, the selection of the Allow All, Allow Listed, Block All,or Block Listed control settings for each communication protocol shownin control settings dialog box 28 results in a record being created inactivity list 122 for each transaction that utilizes one of thesecommunication protocols. In contrast, the selection of the Off controlsetting for each communication protocol shown in Control settings dialogbox 28 result in no record being included in activity list 122 fortransactions that utilizes one of these corresponding communicationprotocols.

If, in FIG. 2, box 39-2 is selected, CCM 98 will block behind-the-scenesdata, transmission, i.e., data that is not directly presented to theuser, such as Internet cookies. Furthermore, if radio button 64-1 inFIG. 5 is selected, CCM 98 will transmit to server computer 2 via secondcommunication session 102 a copy of each transaction. The datacomprising the record for the transaction which is included by SCM 12 inactivity list 122 can be copied from the copy of the transactiontransmitted to server computer 2 via second communication session 102.The copy of each transaction is stored in the cache memory of memoryunit 11 in connection with the corresponding record included in activitylist 122. In order to view the copy of the transaction, theadministrator of server computer 2 can utilize the point and clickmethod to select a desired record in activity list 122 whereupon thecached copy of the transaction for the select record is retrieved fromthe cache memory and displayed on display 15. In a similar manner, ifradio button 64-2 in FIG. 5 is selected, CCM 98 will transmit to servercomputer 2 via second communication session 102 copies of eachtransaction and any encoded attachments along with the data comprisingthe record for the transaction which is included by SCM 12 in activitylist 122. The copies of the transaction and any encoded attachments areincluded in cache memory in connection with the record of thetransaction included in activity list 122. Lastly, if radio button 64-3in FIG. 5 is selected, CCM 98 will not transmit to server computer 2copies of any transactions or any encoded attachments of anytransactions, and will only transmit to server computer 2 for eachtransaction the data comprising the record for the transaction which isincluded by SCM 12 in activity list 122.

With reference to FIG. 8, in addition to the control settings discussedabove, other global control settings can be included in the accessconfiguration for the login name of each user of a client computer 1 andutilized to control access to or from communication software 7. Oneexample of another global control setting includes a control settingbased upon a standardized category rating included in conveyed data bythe provider thereof. In order to set the response of CCM 98 to acontrol setting for the standardized rating, the administrator of servercomputer 2 causes SCM 12 to display on display 15 a PICs Configurationdialog box 150. Dialog box 150 includes a category menu section 152where a selection can be made of the category of data to be controlled.These categories can include, without limitation, violence, sex, nudity,language, etc. For each category of data for which control is desired, asensitivity selection means 154 is provided in dialog box 150 to set thesensitivity of the control setting for each category. Once thesensitivity has been selected for the category, the administrator ofserver computer 2 utilizes the point and click method to select an Okpush button 156 in dialog box 150. The selection of Ok push button 156causes the sensitivity selection for the selected category to be storedin the access configuration for the login name associated with dialogbox 150. Thereafter, when the copy of this access configuration istransferred to client computer 1, CCM 98 compares the standardizedcategory rating included in the conveyed data with the sensitivity forthe same category stored in the access configuration for the login nameof the user of client computer 1. If the standardized category ratingincluded in the conveyed data equals or exceeds the sensitivity selectedfor the same category stored in the access configuration, CCM 98 blocksthe conveyance of data associated with this transaction from beingconveyed to or from communication software 7.

At suitable times, CCM 98 issues a request to SCM 12 via secondcommunication session 102 for SCM 12 to transmit to client computer 1another copy of the access configuration for the login name of the userof client computer 1. This is done to ensure that client computer 1 isutilizing the most current access configuration for the login name ofthe user of client computer 1. Thus, if any changes to the accessconfiguration are made by the administrator of server computer 2, clientcomputer 1 will receive a copy of the current access configuration atthe suitable times, e.g., periodically, every few minutes.

As can be seen, the present invention provides a method for controllingcomputer network access where each user's access to the computer networkcan be selectively monitored and controlled and records of transactionsfor each user can be stored for subsequent retrieval and analysis. Inthe foregoing description, one client computer 1 and one server computer2 were utilized to describe the invention. However, server computer 2can be configured to simultaneously host a plurality of client computers1 up to the number of second network addresses that server computer 2 isconfigured to host. Furthermore, while the present invention wasdescribed in connection with a single, third communication session 104,it is to be appreciated that each user of a client computer 1 caninitiate a plurality of third communication sessions with differentremote computers 3 at different network addresses whereupon each ofthese third communication sessions would be considered a standalone,third communication session.

The software of the present invention is preferably configured so thateach instantiation of communication software 7 has its own instantiationof CCM 98. However, this is not to be construed as limiting theinvention since a single instantiation of CCM 98 can be configured tocontrol access to two or more instantiations of communication software 7on the same client computer 1.

In the foregoing description, a unique access configuration was createdand utilized in connection with each user of a client computer 1.However, additionally or alternatively, SCM 12 can be configured so thatif a login name of a user of client computer 1 does not match a loginname included in an access configuration stored in memory unit 11, SCM12 transmits a copy of a generic access configuration to each clientcomputer 1 having a user not having a login name included in an accessconfiguration stored in memory unit 11. Each client computer 1 receivingthis generic access configuration operates in the foregoing manner forthe control setting and boxes selected in control settings dialog box 28therefor.

Each list 46 and/or 48 can be customized as desired by the administratorof server computer 2 prior to download to a client computer 1. In theforegoing description, the access configuration downloaded to clientcomputer 1 preferably included all of lists 46 and/or 48 associatedtherewith. However, SCM 12 can be configured to download to clientcomputer 2 only the lists 46 and/or 48 related to the selection of thecorresponding Allow Listed or Block Listed control settings for one ormore communication protocols. In this manner, lists 46 and 48 that wouldnot be used by CCM 98 are not stored in the access configurationdownloaded to client computer 1. Still further, each accessconfiguration stored in memory unit 11 of server computer 2 can includeonly the lists 46 and/or 48 related to the selection of thecorresponding Allow Listed or Block Listed control settings for one ormore communication protocols. In this manner, lists 46 and/or 48 thatwould not be used are not stored in the access configuration stored inmemory unit 11.

Lastly, in the foregoing description, third communication session 104was established concurrent with second communication session 102.However, this is not to be construed as limiting the invention since CCM98 can terminate second communication session 102 after receiving theaccess configuration for the user of client computer 1 in memory unit 6.At appropriate times thereafter, CCM 98 can reestablish secondcommunication session 102 with server computer 2 and use thisreestablished second communication session 102 to transmit dataregarding transactions to server computer 2. It is to be appreciated,that while the present invention has been described as transmitting dataregarding each transaction to server computer 2, CCM 98 can store datarelated to a number of transactions in memory unit 6 and, at suitabletimes, can transmit this stored data to server computer 2. In addition,in the event second communication session 102 is terminated and cannotbe reestablished, CCM 98 can use the access configuration downloaded toclient computer 1 and can defer transmitting data regarding transactionsto server computer 2 until second communication session 102 can bereestablished.

The invention has been described with reference to the preferredembodiment. Obvious modifications and alterations will occur to othersupon reading and understanding the preceding detailed description. It isintended that the invention be construed as including all suchmodifications and alterations insofar as they come within the scope ofthe appended claims or the equivalents thereof.

The invention claimed is:
 1. A method of controlling computer networkaccess comprising: (a) a server computer receiving via a computernetwork from an endpoint computer of the computer network a request foran access configuration file; (b) the server computer dispatching tosaid endpoint computer an access configuration file; and (c) followingstep (b), the server computer dispatching to said endpoint computer anupdate to the access configuration file dispatched in step (b) oranother access configuration file.
 2. The method of claim 2, furtherincluding: (d) the server computer storing data received from saidendpoint computer regarding a violation of at least one policy includedin the access configuration file, the updated access configuration file,or the other access configuration file.
 3. A method of controllingcomputer network access comprising: (a) a server computer receiving viaa computer network from endpoint computers of the computer networkrequests for access configuration files; (b) the server computerdispatching a unique access configuration file to each endpoint computerfor which a unique access configuration file was prepared; and (c) theserver computer dispatching a generic access configuration file to eachendpoint computer for which a unique access configuration file was notprepared.
 4. The method of claim 3, further including: (d) the servercomputer controlling storage of data received from one or more endpointcomputers regarding violations of policies included in the dispatchedaccess configuration files.